JP2012220286A - Vehicle control apparatus - Google Patents

Abstract

PROBLEM TO BE SOLVED: To set appropriate fail safe control with respect to abnormality in a vehicle.SOLUTION: When any abnormality is detected by a diagnosis function of a vehicle 10 or a notification switch 19 is operated by a user, the vehicle 10 notifies the occurrence of the abnormality and a position of the vehicle 10 to a service center 40. The service center 40 records therein fail safe control and instructions to users in association with classes of abnormality and positions of vehicles. On the basis of a class of the abnormality transmitted from the vehicle 10 and the position of the vehicle 10, a control device 42 of the service center 40 searches for fail safe control and an instruction suitable therefor. The fail safe control and the instruction are transmitted from the service center 40 to the vehicle 10 and executed by devices 11-19 in the vehicle 10. Thus, appropriate fail safe control corresponding to the position of the vehicle 10 is provided and the suitable instruction is given to the user.

Description

  The present invention relates to a vehicle control device that achieves fail-safe when a vehicle is abnormal.

  2. Description of the Related Art Conventionally, there has been known a control device that performs fail-safe when an abnormality occurs in a vehicle. For example, the device described in Patent Document 1 performs fuel cut control when a vehicle abnormality is detected, and forcibly stops the vehicle. As described above, there is known a device in which a control device mounted on a vehicle executes fail-safe control so that the vehicle becomes safer when an abnormality occurs in the vehicle.

  The device described in Patent Document 2 transmits information to the service center via the Internet when an abnormality of the vehicle is detected, and instructs the vehicle user from the service center on an appropriate treatment method.

JP-A-4-189629 JP 2002-123881 A

  In the technique of Patent Document 1, the fail-safe control when a vehicle abnormality is detected controls the vehicle to the safe side by executing control in which a control device mounted in the vehicle is incorporated in advance. There, fail-safe control is set so that a representative vehicle state that is considered to be safest when the vehicle breaks down is obtained. For example, engine stop, engine speed limit, etc.

  In the technique of Patent Document 2, a service center is instructed to the user from the service center according to the vehicle failure information. However, even in this technique, fail-safe control is set so that a representative vehicle state that is considered to be safest when the vehicle breaks down is obtained.

  Thus, in the prior art, it is not possible to set appropriate fail-safe control according to the travel position of the vehicle such as a highway, a railroad crossing, an urban area, a suburb, and a slope.

  Further, in the prior art, when there is an erroneous operation by the user of the vehicle, the device is functioning normally and an abnormality cannot be detected. For this reason, under a special operation state such as an erroneous operation, it is not possible to set an appropriate fail-safe control corresponding to such an operation state.

  The present invention has been made in view of the above-described problems, and an object of the present invention is to provide a vehicle control device capable of setting appropriate fail-safe control when a vehicle abnormality occurs.

  Another object of the present invention is to provide a vehicle control device capable of setting appropriate fail-safe control in accordance with the travel position of the vehicle.

  Still another object of the present invention is to provide a vehicle control device capable of setting appropriate fail-safe control even under erroneous operation by a vehicle user.

  Still another object of the present invention is to enable remote control of a vehicle by fail-safe control in the event of a vehicle abnormality including an erroneous operation by a user of the vehicle, and a high level in such remote control. It is providing the vehicle control apparatus which can provide reliability.

  The present invention employs the following technical means to achieve the above object.

  According to the first aspect of the present invention, there is provided setting means (161-170, which sets different fail-safe control depending on the state of the vehicle and instructions for the vehicle user based on the type of abnormality in the vehicle and the state of the vehicle. 181-187), execution means (171) for executing fail-safe control in the vehicle, and notification means (171) for notifying the user of an instruction.

  According to this configuration, fail-safe control for taking measures against an abnormality in the vehicle is set. Moreover, the fail-safe control is set differently depending on the state of the vehicle. And this fail safe control is performed in a vehicle. For this reason, appropriate fail-safe control according to the state of the vehicle can be provided. In addition, an instruction for the user of the vehicle to take measures against an abnormality in the vehicle is set. Moreover, different instructions are set according to the state of the vehicle. Then, this instruction is notified to the user in the vehicle. For this reason, an appropriate instruction according to the state of the vehicle can be given to the user.

  The invention according to claim 2 is characterized in that the state of the vehicle includes the position of the vehicle. According to this configuration, different fail-safe controls are set according to the position of the vehicle. For this reason, appropriate fail-safe control according to the position of the vehicle can be provided. Different instructions are set according to the position of the vehicle. For this reason, an appropriate instruction according to the position of the vehicle can be given to the user.

  The invention described in claim 3 is characterized in that the vehicle includes a navigation device (16) for providing data indicating the position of the vehicle. According to this structure, the data which shows the position of a vehicle can be provided by the navigation apparatus mounted in the vehicle.

  According to a fourth aspect of the present invention, the setting means (161-170, 181-187) is provided in the vehicle, the abnormality detection means (162-164) for detecting an abnormality of the vehicle, the vehicle is provided in the vehicle, State detection means (161) for detecting the state, abnormality transmission means (165, 169) provided on the vehicle for transmitting the type of abnormality and the state of the vehicle, and a service connected to the vehicle via a communication line An abnormality receiving means (181, 185) that is provided in the center and receives the type of abnormality and the state of the vehicle, and provided in the service center, in association with a plurality of types of abnormality and a plurality of vehicle states, Based on the database (44) in which a plurality of fail-safe controls and a plurality of instructions are recorded, the type of abnormality received by the abnormality receiving means, and the state of the vehicle, the database is searched for a specific failure. Extraction means (186) for extracting the safety safe control and the specific instruction, control transmission means (187) for transmitting the fail safe control and the instruction extracted by the extraction means to the vehicle, and fail safe control provided in the vehicle. And a control receiving means (170) for receiving the instruction. According to this configuration, the setting means can be provided by the vehicle and the service center.

  The invention according to claim 5 is characterized in that the execution means executes fail-safe control by a control command prepared in advance for a vehicle maintenance work. According to this configuration, fail-safe control can be executed using a control command prepared in advance for vehicle maintenance work. For this reason, it is possible to provide execution means by diverting existing devices and existing software.

  The invention according to claim 6 is characterized in that the abnormality detecting means detects an abnormality of the vehicle by a diagnostic command prepared in advance for the maintenance work of the vehicle. According to this configuration, it is possible to detect a vehicle abnormality using a diagnostic command prepared in advance for vehicle maintenance work. For this reason, an abnormality detection means can be provided by diverting an existing apparatus and existing software.

  The invention according to claim 7 is characterized in that the abnormality detection means includes input means (17, 19) for inputting a request from a vehicle user. According to this configuration, the fail safe control can be set even when the vehicle user senses an abnormality of the vehicle. For this reason, even when the abnormality of the vehicle is caused by the user's erroneous operation and no abnormality occurs in the in-vehicle device, the fail safe control can be set. The input means can be provided by an interface device such as a notification switch operated by a user who has detected an abnormality or a voice input device from which a user who has detected an abnormality requests a notification.

  The invention according to claim 8 is characterized in that the state detection means acquires the state of the vehicle from data flowing in a LAN provided in the vehicle. According to this configuration, the state of the vehicle can be acquired from data on the in-vehicle LAN. For this reason, a state detection means can be provided by diverting an existing apparatus and existing software.

  The invention according to claim 9 is further provided in the service center, and vehicle determining means (182-183) for determining that the vehicle is a legitimate vehicle, and provided in the vehicle, wherein the service center is the legitimate service center. Service center determination means (167, 168) for determining whether the vehicle is a regular vehicle and only when it is determined that the vehicle is a regular service center, Is functional. According to this configuration, use of the service center due to unauthorized access and execution of failsafe control due to unauthorized access can be avoided.

  According to the tenth aspect of the present invention, the vehicle determination means (182-183) and the service center determination means (167, 168) are provided by an authentication function provided by the anti-theft device (12) mounted on the vehicle. It is characterized by being. According to this configuration, unauthorized access can be blocked by the authentication function provided by the in-vehicle antitheft device. For this reason, it is possible to provide the vehicle determination means and the service center determination means by diverting existing devices and existing software.

  The invention according to claim 11 further includes a restricting means for restricting driving of the device mounted on the vehicle by fail-safe control when no abnormality of the vehicle is detected, and the executing means releases the restriction by the restricting means. And performing fail-safe control. According to this configuration, when an abnormality of the vehicle is not detected, that is, in a normal state, driving of the in-vehicle device is limited by the limiting unit so as not to perform a special operation by fail-safe control. When the vehicle is abnormal, the execution means deliberately releases the restriction by the restriction means in order to escape from the abnormal state or to alleviate the abnormal state, and drives the in-vehicle device by fail-safe control.

  Note that the reference numerals in parentheses described in the claims and the above-described means indicate the correspondence with the specific means described in the embodiments described later as one aspect, and are technical terms of the present invention. It does not limit the range.

It is a block diagram showing a control device for vehicles concerning a 1st embodiment to which the present invention is applied. It is a flowchart which shows the action | operation of 1st Embodiment.

  A plurality of modes for carrying out the present invention will be described below with reference to the drawings. In each embodiment, parts corresponding to the matters described in the preceding embodiment may be denoted by the same reference numerals, and redundant description may be omitted. When only a part of the configuration is described in each mode, the other modes described above can be applied to the other parts of the configuration. Not only combinations of parts that clearly show that combinations are possible in each embodiment, but also combinations of the embodiments even if they are not explicitly stated unless there is a problem with the combination. Is also possible.

(First embodiment)
FIG. 1 is a block diagram showing a vehicular control apparatus 1 constituting a vehicular remote control system according to a first embodiment to which the present invention is applied.

  The vehicle control device 1 is constructed by an electronic control unit (ECU: Electronic Control Unit) mounted on the vehicle 10 and a control device installed in a service center 40 placed on the ground. The vehicle-mounted control device and the service center control device are communicably connected to each other by communication means such as the wide area network 30 to construct an integrated vehicle control device 1.

  The vehicle control device 1 includes an in-vehicle device 11-19 mounted on the vehicle 10. The vehicle 10 is a vehicle using only an engine as a power source, a vehicle using only a motor as a power source, or a vehicle using a motor and an engine as power sources.

  The vehicle 10 includes a vehicle-mounted LAN 11. The plurality of in-vehicle devices 12-19 are configured to be capable of data communication with each other via the LAN 11. The LAN 11 can be provided by a network called LIN (Local Interconnect Network) or CAN (Controller Area Network), for example.

  The vehicle 10 includes an anti-theft ECU 12. The anti-theft ECU 12 determines whether or not the vehicle 10 can be used based on an encrypted identification signal (also referred to as ID) stored in a portable storage device such as a key or IC card associated with the vehicle 10. The anti-theft ECU 12 keeps the vehicle 10 usable when authentication based on the identification signal is established. This anti-theft ECU 12 puts the vehicle in a state where it cannot travel when authentication based on the identification signal is not established. Therefore, the anti-theft ECU 12 also functions as a so-called immobilizer. The anti-theft ECU 12 has an advanced encryption function and authentication function as an immobilizer. The anti-theft ECU 12 also functions as an alarm device that executes anti-theft countermeasure processing such as outputting an alarm sound when detecting an act of illegally moving the vehicle.

  The vehicle 10 includes a plurality of devices 13-15 that are targets of fail-safe control. Devices that are subject to fail-safe control include devices related to the traveling of the vehicle 10. For example, the equipment that is subject to fail-safe control can include an engine ECU 13 that is a control device for controlling a power source for traveling of the vehicle 10. Further, the devices that are subject to fail-safe control can include a transmission ECU 14 that is a control device for controlling transmission of power for traveling of the vehicle 10. Moreover, the brake ECU 15 that is a control device for controlling the braking force of the vehicle 10 can be included in the devices that are subject to fail-safe control. Furthermore, the devices that are subject to fail-safe control can include a plurality of devices related to the traveling of the vehicle 10, such as an ECU for controlling the constant speed traveling.

  The vehicle 10 includes an engine ECU 13. The engine ECU 12 controls an engine (internal combustion engine) mounted on the vehicle 10. The engine ECU 13 controls, for example, the fuel injection amount supplied to the engine and the ignition timing of the engine. Furthermore, the engine ECU 13 can control the vehicle 10 to the safe side, for example, by gradually reducing the output of the engine by executing fail-safe control.

  The vehicle 10 includes a transmission ECU 14. The transmission ECU 14 controls the transmission of the vehicle 10. The transmission is provided between a motor and / or engine as a power source of the vehicle 10 and drive wheels. For example, the transmission ECU 14 controls the transmission so as to intermittently transmit the driving force from the power source to the driving wheels. Moreover, transmission ECU14 controls the deceleration rate in a transmission, for example. The transmission ECU 14 can control the vehicle 10 to the safe side, for example, by gradually reducing power transmission by the transmission by executing fail-safe control.

  The vehicle 10 includes a brake ECU 15. The brake ECU 15 controls the brake device of the vehicle 10. For example, signals from an acceleration sensor and a wheel speed sensor are input to the brake ECU 15. The acceleration sensor detects the acceleration of the vehicle body of the vehicle 10. The wheel speed sensor detects the rotational speed of the wheel. The vehicle 10 includes a plurality of wheel speed sensors so as to correspond to each of the plurality of wheels. The brake ECU 15 can control the vehicle 10 to the safe side, for example, gradually increasing the braking force by executing fail-safe control.

  The vehicle 10 includes a navigation ECU 16. The navigation ECU 16 is a navigation device that displays the travel position of the vehicle 10 on a map. The navigation ECU 16 includes an input / output device 17 and a communication terminal 18. The input / output device 17 is a user interface device, and can include, for example, a display device, a switch group including a touch panel provided in the display device, and a voice input / output device. The communication terminal 18 provides data communication via the wide area network 30 by using a communication line such as wireless communication. The communication terminal 18 is also connected to the LAN 11. Thereby, data communication between the plurality of in-vehicle devices 12-19 and the wide area network 30 is enabled.

  The vehicle 10 includes a notification switch 19 that is operated by a user including the driver of the vehicle 10. The notification switch 19 is provided for the user of the vehicle 10 to input an intention to report the abnormality of the vehicle 10 detected by the user to the service center. Furthermore, the voice input / output device of the input / output device 17 also functions as a means for inputting a report request by the user's voice.

  The plurality of devices 11-19 mounted on the vehicle 10 are configured to be connectable to a diagnosis terminal 20 that is a service tool used for vehicle maintenance work. The diagnostic terminal 20 is a diagnostic device that diagnoses the state of the plurality of devices 11-19. The diagnostic terminal 20 is placed in a repair shop, for example. The diagnostic terminal 20 is connected to the LAN 11 and operates like a device mounted on the vehicle 10 only when necessary.

  The diagnostic terminal 20 can output a plurality of diagnostic command signals (hereinafter referred to as diagnostic commands) for diagnosing the operating states of the plurality of in-vehicle devices 11-19. The device 11-19 is configured to execute a self-diagnosis indicated by the diagnosis command and return the diagnosis result. As a result, diagnostic results are collected in the diagnostic terminal 20.

  Further, the diagnostic terminal 20 can output a plurality of control command signals (hereinafter referred to as control commands) for forcing the plurality of in-vehicle devices 11-19 to a predetermined operating state. The device 11-19 that has received the control command from the diagnosis terminal 20 forcibly shifts to the operation state indicated by the control command. Such control commands are used to test and maintain the functionality of the equipment 11-19. In order to achieve such an object, the devices 11-19 are configured to execute control commands in preference to the restrictions provided in the devices. Specifically, even if the device 11-19 is provided with a restriction for transitioning to a specific operating state, if a control command is received, it will prevail over such restriction or such restriction. And the device 11-19 is configured to transition to the specific operating state indicated by the control command.

  In this embodiment, the navigation ECU 16 also functions as a control device that executes control processing related to fail-safe control. The navigation ECU 16 is configured to be able to output diagnostic commands prepared for the diagnostic terminal 20 to a plurality of devices 11-19. Thereby, navigation ECU16 can instruct | indicate the detection of the abnormality by a self-diagnosis with respect to several apparatus 11-19. Generation | occurrence | production of abnormality in each part of the vehicle 10 is detected in each of several apparatus 11-19. The occurrence of an abnormality may be detected by the notification switch 19. In addition, the occurrence of an abnormality may be detected by a user's voice input to the voice input / output device. The occurrence of an abnormality is reported to the navigation ECU 16 via the LAN 11. The navigation ECU 16 evaluates the importance of the abnormality in the vehicle 10 and notifies the service center 40 of the abnormality having such a high degree of importance that the notification is necessary.

  The navigation ECU 16 instructs the plurality of devices 12-19 to perform fail-safe control transmitted from the service center 40. The fail safe control can be executed using a command prepared for each ECU for repair or adjustment of the vehicle 10. Such a command is also called a control command or a forced drive command. For example, a command for driving a predetermined actuator to a predetermined state and a command for controlling the engine idle speed to a predetermined speed are prepared. The fail safe control can be executed by using such a control command.

  The navigation ECU 16 is configured to be able to output a control command prepared for the diagnostic terminal 20 to a plurality of devices 11-19. Thereby, navigation ECU16 can instruct | indicate the forced control by a control command with respect to the some apparatus 11-19, ie, fail safe control. By using a control command prepared for the diagnostic terminal 20 in fail-safe control, it is possible to suppress the amount of program newly provided only for fail-safe control. As a result, fail safe control is executed in each of the plurality of devices 12-19.

  Further, the navigation ECU 16 notifies the user of the vehicle 10 of the instruction transmitted from the service center 40. For example, the message transmitted from the service center 40 is displayed on the display device of the input / output device 17. For example, the message includes a desired operation of the vehicle 10. In addition, a message transmitted from the service center 40 may be notified to the user as a voice by a voice input / output device.

  The vehicle control device 1 includes devices 41 to 44 provided in the service center 40. The service center 40 is installed as equipment common to the plurality of vehicles 10. The service center 40 is provided with a communication terminal 41. The communication terminal 41 provides data communication via the wide area network 30 using a wireless communication line.

  The service center 40 is provided with a control device 42 for setting fail-safe control. The communication terminal 41 is also connected to the control device 42. Thereby, data communication between the control device 42 and the wide area network 30 is enabled. As a result, the control device 42 and the plurality of in-vehicle devices 11-19 are configured to be capable of data communication with each other.

  The service center 40 is provided with a vehicle database (VHDB) 43 in which identification information for identifying the vehicle 10 to be provided with the service by the vehicle control device 1 is recorded. The VHDB 43 is used when the control device 42 performs an authentication process for determining whether or not the vehicle 10 that has reported the abnormality and requested the setting of fail-safe control is a service providing target.

  The service center 40 is provided with a fail safe control database (FSDB) 44 in which a plurality of fail safe controls to be executed in the vehicle 10 are recorded. The FSDB 44 includes a plurality of types of abnormality that may occur in the vehicle 10, a plurality of vehicle states that may occur in the vehicle 10 including the position of the vehicle 10, a plurality of fail-safe controls, and a plurality of items for the user. Instructions are recorded in association with each other. The fail safe control and the instruction are recorded so as to be searchable based on the type of abnormality and the position of the vehicle 10. The fail safe control and the instruction recorded in the FSDB 44 may be different for each type of abnormality. For example, fail-safe control for an abnormality in which the speed of the vehicle 10 does not increase may be different from fail-safe control for an abnormality in which the speed of the vehicle 10 does not decrease.

  Further, in this embodiment, the fail-safe control and the instruction recorded in the FSDB 44 may differ depending on the position of the vehicle 10 even if the abnormality type is the same. For example, fail-safe control and an instruction for an abnormality in which the speed of the vehicle 10 does not increase are different depending on whether the vehicle 10 is in a parking lot or a level crossing. For example, when the vehicle 10 is in a parking lot, fail-safe control and instructions for maintaining the vehicle 10 in a stopped state and waiting for repairs by an expert are recorded. Further, when the vehicle 10 is at a railroad crossing, fail-safe control and instructions for causing the vehicle 10 to escape from the railroad crossing are recorded.

  Such recording of the FSDB 44 is used in the following specific examples of fail-safe control and instructions. The first example is a case where the engine of the vehicle 10 is stopped at a railroad crossing. In this case, the transmission ECU 14 controls the automatic transmission to a directly connected state by fail-safe control from the service center 40. For example, the automatic transmission is controlled to a lockup mode. Furthermore, the engine ECU 13 allows the starter motor to be driven by fail-safe control from the service center 40. For example, the engine ECU 13 cancels the restriction control that prohibits the starter motor from being driven when the brake is not operated. As a result, the vehicle 10 is set in a movable state by the starter motor even when the engine is stopped. Further, the instruction transmitted from the service center 40 includes a message for the driver. This message includes a method of moving the vehicle 10 by operating the starter motor. This message is displayed on the display device of the input / output device 17 by the navigation ECU 16. A 2nd example is a case where the engine of the vehicle 10 stops in a parking lot. In this case, the transmission ECU 14 controls the automatic transmission so as to cut off power transmission by fail-safe control from the service center 40. Thereby, the vehicle 10 remains stopped in the parking lot. Further, the instruction transmitted from the service center 40 includes a message for the driver. This message includes advice to call a specialist such as a repairer. This message is displayed on the display device of the input / output device 17 by the navigation ECU 16.

  In another example, the fail-safe control and instruction for an abnormality that the speed of the vehicle 10 does not decrease is different between when the vehicle 10 is on a city road and when it is on a highway. For example, when the vehicle 10 is on an urban road, fail-safe control and instructions for gradually decelerating and stopping the vehicle 10 are recorded. Further, when the vehicle 10 is on an expressway, the vehicle 10 is gradually decelerated, but fail-safe control and instructions for permitting travel to a parking area such as a service area are recorded.

  Such recording of the FSDB 44 is used in the following specific examples of fail-safe control and instructions. The third example is a case where an engine intake throttle valve is open and malfunctions on a highway. In this case, the transmission ECU 14 fixes the automatic transmission to a reduction ratio for low-speed traveling by fail-safe control from the service center 40. For example, an automatic transmission is fixed to a low range. Further, the engine ECU 13 sets the fuel cut speed of the engine to a speed lower than the normal value. Thereby, even if the intake throttle valve is fully open, the engine speed is limited to a relatively low speed. As a result, the vehicle 10 is controlled so as to be able to travel at a low speed. This state is maintained up to the nearest service area. The fourth example is a case where a malfunction occurs while the intake throttle valve of the engine is open on an urban road. In this case, the transmission ECU 14 fixes the automatic transmission to a reduction ratio for low-speed traveling by fail-safe control from the service center 40. For example, an automatic transmission is fixed to a low range. Further, the engine ECU 13 gradually decreases the fuel cut speed of the engine. Thereby, even if the intake throttle valve is fully open, the engine speed gradually decreases. The decrease in the engine speed at this time is set so that the vehicle 10 can travel by several tens of meters. As a result, the driver can move the vehicle 10 to the shoulder of the city road. The vehicle 10 stops slowly before long.

  As another example, a case where an abnormality is reported on a highway and a case where an abnormality is reported on an urban road can be considered. When an abnormality is reported on the expressway, fail-safe control is set so that the engine fuel cut speed is gradually reduced at the first speed. Thus, the driver can gradually decelerate the vehicle 10 and move to a safe place such as a road shoulder without significantly hindering a fast traffic flow on the highway. On the other hand, when an abnormality is reported on an urban road, fail-safe control is set so that the engine fuel cut speed is gradually reduced at the second speed. The second speed is faster than the first speed. Thus, the driver can gradually decelerate the vehicle 10 and move to a safe place such as a road shoulder without obstructing a relatively slow traffic flow on an urban road.

  The control device 42 functions as an authentication unit that executes an authentication process. The authentication process is executed based on the identification information recorded in the VHDB 43 and the identification information transmitted from the vehicle 10. In the authentication process, it is determined whether or not the vehicle 10 that has requested the setting of fail-safe control by reporting an abnormality is a regular vehicle 10 registered as a service provision target.

  The control device 42 functions as a setting unit that executes setting processing for setting fail-safe control and instructions. The setting process is executed based on data transmitted from the vehicle 10 and the contents recorded in the FSDB 44. In the setting process, the contents of the FSDB 44 are searched based on the abnormal state of the vehicle 10 and the position of the vehicle 10, fail-safe control and instructions suitable for the abnormal state and position are extracted, and these are transmitted to the vehicle 10. Is done.

  The control device provided in the vehicle 10 and the service center 40 is provided by a microcomputer provided with a computer-readable storage medium. The storage medium stores a computer-readable program. The storage medium can be provided by a memory. By being executed by the control device, the program causes the control device to function as the device described in this specification, and causes the control device to function so as to execute the control method described in this specification. The means provided by the control device can also be called a functional block or module that achieves a predetermined function.

  FIG. 2 is a flowchart showing the operation of the first embodiment. In the figure, a control process 160 executed in the vehicle 10 and a control process 180 executed in the service center 40 are shown. The control treatment 160 and the control processing 180 indicate processing for setting fail-safe control for taking measures against an abnormality of the vehicle 10 as a whole. Further, the control treatment 160 and the control processing 180 constitute a remote control means for remotely controlling the vehicle 10 as a whole.

  The control process 160 is repeatedly executed when the vehicle 10 is in an operating state. The control process 160 is executed by the navigation ECU 16. The control process 160 can also be executed in other ECUs such as the engine ECU 13.

  In step 161, data indicating the state of the vehicle 10 is detected and accumulated. Thereby, the history data which shows the change of the state of the vehicle 10 is comprised. The history data is used as data indicating the type of abnormality of the vehicle 10. Step 161 is provided in the vehicle 10 and provides state detection means for detecting the state of the vehicle 10. Here, the state of the vehicle is acquired from data flowing in the LAN 11 provided in the vehicle 10. According to this configuration, the state of the vehicle 10 can be acquired from data on the in-vehicle LAN 11. For this reason, a state detection means can be provided by diverting an existing apparatus and existing software.

  In step 162, an abnormal state of the vehicle 10 is detected. Here, the abnormal state includes an abnormality detected by the self-diagnosis process by the in-vehicle device 11-19 and an abnormality sensed by a user on the vehicle 10. The abnormality detected by the self-diagnosis is input to the navigation ECU 16 via the LAN 11. Step 162 is provided in the vehicle 10 and provides an abnormality detection means for detecting an abnormality of the vehicle 10. Here, the abnormality of the vehicle is detected by a diagnostic command prepared in advance for the vehicle maintenance work. An abnormality of the vehicle can be detected by using a diagnostic command prepared in advance for vehicle maintenance work. For this reason, an abnormality detection means can be provided by diverting an existing apparatus and existing software.

  The abnormality sensed by the user is input to the navigation ECU 16 when the user operates the notification switch 19 or when the user inputs a voice requesting notification to the input / output device 17. The abnormality detection means provided by step 162 provides an input means for inputting a request from the user of the vehicle 10. According to this configuration, even when the user of the vehicle 10 senses an abnormality in the vehicle, the abnormality can be reported and the setting of fail-safe control can be obtained. For this reason, even when the abnormality of the vehicle 10 is caused by a user's erroneous operation and no abnormality occurs in the in-vehicle device, the fail safe control can be set. The input means can be provided by an interface device such as a notification switch operated by a user who has detected an abnormality or a voice input device from which a user who has detected an abnormality requests a notification.

  Here, for example, abnormalities including failures listed below are detected. For example, an engine intake throttle valve failure is detected. Moreover, the stop of the vehicle by it is detected. Further, an excessive engine speed over a predetermined period is detected. Further, a report request from the user is also detected as an abnormality of the vehicle 10.

  In step 163, the importance of the abnormal condition is evaluated. Here, it is determined whether there is an abnormality that requires notification to the service center 40. The abnormality detected by the self-diagnosis may be a report target or may not be a report target depending on the importance. For example, when the vehicle 10 cannot move, when the vehicle 10 cannot stop, and when the vehicle 10 exhibits an unintended behavior, it is evaluated as a high degree of importance worthy of notification. On the other hand, when the notification switch 19 is operated, the notification switch 19 is always subject to notification by evaluating with high importance.

  In step 164, it is determined whether or not notification is necessary according to the importance. If the report is unnecessary, the process returns to step 161. If notification is required, go to step 165.

  In step 165, the occurrence of abnormality is notified from the vehicle 10 to the service center 40. At this time, identification information of the vehicle 10 is also transmitted.

  In step 181, the service center 40 receives a report from the vehicle 10. In step 182, an authentication process for determining whether or not the vehicle 10 is a vehicle registered as a service providing target is executed. In step 183, it is determined whether authentication has been established. If the vehicle 10 is a regular vehicle, authentication is established. If the authentication is not established, the process returns to step 181. The processing of steps 165, 181, 182, and 183 provides a first authentication means for authenticating the vehicle 10 at the service center 40. If authentication is established in step 183, the process proceeds to step 184.

  In step 184, an identification signal (center ID) for identifying the service center 40 is transmitted from the service center 40 to the vehicle 10. In step 166, the vehicle 10 receives the center ID. In step 167, an authentication process for determining whether or not the center 40 is an authorized service center 40 is executed. In step 168, it is determined whether authentication has been established. If the service center 40 is an authorized organization, authentication is established. If authentication is not established, the process returns to step 161. The processing in steps 184, 166, 167, 168 provides a second authentication means for authenticating the service center 40 in the vehicle 10. The second authentication means prevents inappropriate fail-safe control and / or instructions from being set by someone who is not authorized. If authentication is established in step 168, the process proceeds to step 169.

  In this embodiment, steps 182-183 are provided in the service center 40 and provide vehicle determination means for determining that the vehicle 10 is a regular vehicle. Steps 167 to 168 provide service center determination means that is provided in the vehicle 10 and determines that the service center 40 is a regular service center. Only when it is determined that the vehicle is a legitimate vehicle by these means and is a legitimate service center, the subsequent execution means and the notification means function. According to this configuration, use of the service center due to unauthorized access and execution of failsafe control due to unauthorized access can be avoided.

  The vehicle determination means and the service center determination means are provided by an authentication method that realizes high security. The vehicle determination means and the service center determination means are provided by encrypted communication. Furthermore, the vehicle determination means and the service center determination means are provided by using the same algorithm as that of the immobilizer cryptographic calculation provided by the anti-theft ECU 12 mounted on the vehicle 10, that is, an authentication function. As a result, it is confirmed that the notification is legitimate and that the compulsory control by the failsafe control is legitimate. According to this configuration, unauthorized access can be blocked by the authentication function provided by the in-vehicle antitheft device (theft prevention ECU 12). For this reason, it is possible to provide the vehicle determination means and the service center determination means by diverting existing devices and existing software. As a result, only regular fail-safe control can be executed using the in-vehicle authentication function.

  In step 169, data indicating the state of the vehicle 10 is transmitted from the vehicle 10 to the service center 40. This data includes at least data indicating the type of abnormality of the vehicle 10 and data indicating the position of the vehicle 10. The position of the vehicle 10 is data provided and provided in the navigation ECU 16 that constitutes the navigation device. This data can include the history data accumulated in step 161. Further, this data can include data indicating the state of the vehicle 10 after the abnormality is detected in step 162. Such data indicating the state of the vehicle 10 before and after the abnormality contributes to subdividing the type of abnormality. Step 165 and step 169 are provided in the vehicle 10 and provide an abnormality transmission means for transmitting the type of abnormality of the vehicle 10 and the state of the vehicle 10.

  More specifically, the data transmitted in step 169 can include the data listed below. (1) Vehicle information before and after abnormality. (2) Fault information of each ECU. (3) Engine speed. (4) Vehicle speed. (5) Gear position. (6) The position of the vehicle 10. These data are acquired using a diagnostic command prepared for the diagnostic terminal 20. These data are acquired from data on the LAN 11.

  In step 185, the service center 40 receives data indicating the state of the vehicle 10. Step 181 and step 185 are provided in the service center 40 connected to the vehicle 10 via a communication line, and provide an abnormality receiving means for receiving the type of abnormality of the vehicle 10 and the state of the vehicle 10.

  In step 186, the control device 42 searches the FSDB 44 for appropriate failsafe control (FS control) and instructions. Step 186 provides an extracting means for searching the database 44 based on the type of abnormality received by the abnormality receiving means and the state of the vehicle 10 and extracting specific fail-safe control and specific instructions.

  In step 187, the fail safe control and the instruction are transmitted from the service center 40 to the vehicle 10. Step 187 provides a control transmission means for transmitting the fail safe control and the instruction extracted by the extraction means to the vehicle 10. In step 170, the vehicle 10 receives fail-safe control and instructions. Step 170 is provided in the vehicle 10 and provides a control receiving means for receiving fail-safe control and instructions. Here, the fail ECU 16 receives the fail safe control and the instruction.

  Step 161-170 and step 181-187 set different fail-safe control depending on the state of the vehicle 10 and instructions for the user of the vehicle 10 based on the type of abnormality in the vehicle 10 and the state of the vehicle 10. Provides setting means. According to this embodiment, fail-safe control for taking measures against an abnormality in the vehicle 10 is set. Moreover, the fail-safe control is set differently depending on the state of the vehicle 10, for example, the position of the vehicle 10. In addition, an instruction for the user of the vehicle 10 is set to take measures against an abnormality in the vehicle 10. In addition, different instructions are set according to the state of the vehicle 10, for example, the position of the vehicle 10.

  In step 171, failsafe control and instructions are executed in the vehicle 10. Here, the navigation ECU 16 instructs the target device of the plurality of devices 11-19 to perform fail-safe control, and the device performs the fail-safe control. Here, for example, fail safe control may be executed in the engine ECU 13. Further, there may be a case where fail safe control is executed by the navigation ECU 16 itself.

  Step 171 provides execution means for executing fail-safe control. Thereby, the appropriate fail safe control according to the state of the vehicle 10, for example, the position of the vehicle 10, can be provided. Here, fail-safe control is executed by a forced drive command (control command) prepared in advance for vehicle maintenance work. According to this configuration, fail-safe control can be executed using a control command prepared in advance for vehicle maintenance work. For this reason, it is possible to provide execution means by diverting existing devices and existing software. In fail-safe control, a forced drive command for driving an actuator belonging to a normal ECU is transmitted.

  Here, the vehicle-mounted device 11-19 including a plurality of ECUs 12-16 provides a control means for operating these devices when an abnormality of the vehicle 10 is not detected. Furthermore, these control means provide a limiting means for restricting the drive of the device mounted on the vehicle by fail-safe control when no abnormality of the vehicle 10 is detected. For example, the restricting means restricts (prohibits) driving the starter motor without operating the brake. However, the execution means provided by step 171 cancels the restriction by the restriction means and executes fail-safe control. According to this configuration, when an abnormality of the vehicle 10 is not detected, that is, when it is normal, the in-vehicle device 11-19 is restricted by the restricting unit so as not to perform a special operation by fail-safe control. When the vehicle 10 is abnormal, the execution means deliberately releases the restriction by the restriction means in order to escape from the abnormal state or alleviate the abnormal state, and drive the in-vehicle device 11-19 by fail-safe control. To do.

  Further, in step 171, an instruction is notified to the user by the input / output device 17 of the navigation ECU 16. For example, the instruction is displayed on the display device. In addition, the instruction is output as voice by the voice generation device. Step 171 provides a notification means for notifying the user of an instruction in the vehicle 10. Thereby, an appropriate instruction according to the state of the vehicle 10, for example, the position of the vehicle 10, can be given to the user.

  In step 172, the result of the fail safe control is transmitted from the vehicle 10 to the service center 40. For example, the result is transmitted to the navigation ECU 16 from the device that is subject to fail-safe control, and the result is further transmitted from the navigation ECU 16 to the control device 42 of the service center 40. In step 173, it is determined whether or not the treatment by the fail safe control is completed. When fail-safe control is completed, a series of processing ends. On the other hand, when fail-safe control is not completed, it returns to step 171 and continues fail-safe control.

  In step 188, the service center 40 receives the result of the fail safe control. In step 189, it is determined whether or not the treatment by the failsafe control is completed. When fail-safe control is completed, a series of processing ends. On the other hand, if fail-safe control is not completed, the process returns to step 188 to wait for completion of fail-safe control.

  According to this embodiment, using the interface of the navigation system of the vehicle 10, communication including an abnormality report and a countermeasure instruction for the abnormality is possible between the user of the vehicle 10 and the service center 40. . When the vehicle 10 is in an abnormal state, there is a possibility that the user will panic and take appropriate measures. However, according to this embodiment, appropriate failsafe control is forcibly executed according to the setting in the service center 40. Furthermore, since the support by the instruction from the service center 40 is also provided to the user of the vehicle 10, an appropriate treatment can be performed.

  Further, in this embodiment, mutual authentication processing is executed in both the vehicle 10 and the service center 40 in order to prevent problems due to unauthorized actions such as impersonation. For this reason, unauthorized fail-safe control can be prevented. Further, the authentication process can be executed using the same algorithm as the cryptographic operation of the immobilizer mounted on the vehicle 10.

  In addition, since the commands prepared for the diagnostic terminal 20 are used for abnormality detection and fail-safe control, the actuators can be driven without major changes to the existing vehicle control software. Is possible.

(Other embodiments)
The preferred embodiments of the present invention have been described above, but the present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the spirit of the present invention. The structure of the said embodiment is an illustration to the last, Comprising: The scope of the present invention is not limited to the range of these description. The scope of the present invention is indicated by the description of the scope of claims, and further includes meanings equivalent to the description of the scope of claims and all modifications within the scope.

  For example, the means and functions provided by the control device can be provided by software only, hardware only, or a combination thereof. For example, the control device may be configured by an analog circuit.

  DESCRIPTION OF SYMBOLS 1 Control apparatus for vehicles, 10 Vehicle, 11 LAN, 12 Anti-theft ECU, 13 Engine ECU. 14 transmission ECU, 15 brake ECU, 16 navigation ECU, 17 input / output device, 18 communication terminal. 19 Report switch, 20 Diag terminal, 30 Wide area network, 40 Service center, 41 Communication terminal, 42 Control device, 43 Vehicle database (VHDB), 44 Failsafe control database (FSDB).

Claims (11)

Setting means (161-170, 181-187) for setting different fail-safe controls and instructions for the user of the vehicle based on the type of abnormality in the vehicle and the state of the vehicle;
Execution means (171) for executing the fail-safe control in the vehicle;
A vehicle control apparatus comprising: a notification unit (171) for notifying the user of the instruction.   The vehicle control device according to claim 1, wherein the vehicle state includes a position of the vehicle.   The vehicle control device according to claim 2, wherein the vehicle includes a navigation device (16) that provides data indicating a position of the vehicle. The setting means (161-170, 181-187)
An abnormality detection means (162-164) provided in the vehicle for detecting an abnormality of the vehicle;
A state detecting means (161) provided in the vehicle for detecting the state of the vehicle;
An abnormality transmitting means (165, 169) provided in the vehicle for transmitting the type of abnormality and the state of the vehicle;
An abnormality receiving means (181, 185) provided in a service center connected to the vehicle via a communication line for receiving the type of abnormality and the state of the vehicle;
A database (44) provided in the service center, which records a plurality of fail-safe controls and a plurality of instructions in association with a plurality of abnormality types and a plurality of vehicle states;
An extraction unit (186) that searches the database based on the type of abnormality received by the abnormality reception unit and the state of the vehicle, and extracts a specific fail-safe control and a specific instruction;
Control transmission means (187) for transmitting the fail-safe control and the instruction extracted by the extraction means to the vehicle;
The vehicle control device according to claim 3, further comprising control receiving means (170) provided in the vehicle for receiving the fail-safe control and the instruction.   The vehicle control device according to claim 4, wherein the execution unit executes the fail-safe control by a control command prepared in advance for the maintenance work of the vehicle.   6. The vehicle control device according to claim 4, wherein the abnormality detection unit detects an abnormality of the vehicle by a diagnostic command prepared in advance for maintenance work of the vehicle.   The vehicle control device according to any one of claims 4 to 6, wherein the abnormality detection means includes input means (17, 19) for inputting a request from a user of the vehicle.   The vehicle control device according to claim 4, wherein the state detection unit acquires the state of the vehicle from data flowing in a LAN provided in the vehicle. further,
Vehicle determination means (182-183) provided in the service center for determining that the vehicle is a regular vehicle;
Service center determination means (167, 168) provided in the vehicle for determining that the service center is a regular service center,
9. The method according to claim 4, wherein the execution unit and the notification unit function only when it is determined that the vehicle is a legitimate vehicle and is a legitimate service center. The vehicle control device according to claim 1.   The vehicle determination means (182-183) and the service center determination means (167, 168) are provided by an authentication function provided by an anti-theft device (12) mounted on the vehicle. The vehicle control device according to claim 9. Further, when no abnormality of the vehicle is detected, the vehicle includes a limiting unit that limits driving of the device mounted on the vehicle by the failsafe control,
The vehicle control device according to any one of claims 1 to 10, wherein the execution unit performs the fail-safe control by releasing the limitation by the limitation unit.

Images